Skip to main content

Metacrm CVE-2025-7875

MEDIUM
Improper Authentication (CWE-287)
2025-07-20 cna@vuldb.com
Authentication Bypass Metacrm
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 19:15 vuln.today
CVE Published
Jul 20, 2025 - 08:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authentication bypass in MetaCRM up to 6.4.2 allows unauthenticated remote attackers to gain unauthorized access via the /debug.jsp endpoint. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed (no CISA KEV listing). The vulnerability carries a medium base score (CVSS 5.5) and a low exploitation probability (EPSS 0.12%).

More in Metacrm

View all
CVE-2026-16324 MEDIUM POC
5.5 Jul 20

Unrestricted file upload in Metasoft (美特软件) MetaCRM up to 6.4.0 Beta06 exposes a network-accessible, unauthenticated upl
CVE-2026-8758 MEDIUM POC
5.5 May 17

Unrestricted file upload in Metasoft MetaCRM (versions up to 6.4.0 Beta06) allows remote unauthenticated attackers to up
CVE-2026-6629 MEDIUM POC
5.5 Apr 20

SQL injection in Metasoft MetaCRM versions up to 6.4.0 allows remote unauthenticated attackers to execute arbitrary SQL

CVE-2025-7876 LOW POC
2.1 Jul 20

Remote code execution in Metasoft MetaCRM through 6.4.2 allows authenticated remote attackers to execute arbitrary code

CVE-2025-7879 LOW POC
2.1 Jul 20

Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 via the mobileupload.jsp endpoint allows authenticated

CVE-2025-7877 LOW POC
2.1 Jul 20

Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitra
CVE-2025-7880 LOW POC
2.1 Jul 20

Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitra
CVE-2025-7878 LOW POC
2.1 Jul 20

Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitra
CVE-2025-7873 LOW POC
2.1 Jul 20

SQL injection in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to execute arbitrary SQL com
CVE-2026-10205 LOW POC
2.1 Jun 01

Unrestricted file upload in Metasoft MetaCRM 6.4.0 allows low-privileged authenticated remote attackers to upload arbitr

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-7875 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy